POPIA Compliance | FFP Radio Distribution

Fully Compliant with South African POPIA

1. Introduction to POPIA

The Protection of Personal Information Act, 2013 (POPIA) is South Africa's data protection law that regulates how personal information must be processed. FFP Radio Distribution is fully committed to complying with POPIA and protecting the personal information of all users, artists, and rights holders.

Information Officer: Malcolm Lewis
Email: info@ffpradio.co.za
Registered with the Information Regulator of South Africa.

2. Personal Information We Collect

We collect and process personal information necessary for the provision of our distribution services, including:

Identity Information: Full name, date of birth, ID number or passport number, nationality.
Contact Information: Email address, phone number, physical address.
Financial Information: Bank account details, tax reference number, payment history.
Professional Information: Artist name, stage name, discography, biographical information.
Technical Information: IP address, device information, login history.
Content Metadata: Song titles, credits, ISRC codes, UPC codes.

3. Purpose of Processing

We process personal information for the following lawful purposes:

To provide digital music distribution services to DSPs.
To process royalty payments and financial transactions.
To comply with legal and regulatory obligations, including tax reporting.
To communicate with you regarding your account, releases, and platform updates.
To prevent fraud, unauthorised access, and illegal activities.
To improve our services and user experience through analytics.

4. POPIA Principles (Conditions for Lawful Processing)

FFP Radio Distribution adheres to all eight POPIA principles:

1. Accountability

We take full responsibility for ensuring compliance with POPIA and have appointed an Information Officer to oversee data protection practices.

2. Processing Limitation

We only collect personal information directly from you, with your consent, and for lawful purposes. We do not collect excessive information.

3. Purpose Specification

Personal information is collected for specific, explicitly defined, and lawful purposes related to our services.

4. Further Processing Limitation

We do not use personal information for purposes incompatible with the original purpose of collection without your consent.

5. Information Quality

We take reasonable steps to ensure personal information is complete, accurate, not misleading, and updated where necessary.

6. Openness

We maintain transparency about our data processing activities and provide this policy to inform you of your rights.

7. Security Safeguards

We implement appropriate technical and organisational measures to protect personal information against loss, unauthorised access, and unlawful processing.

8. Data Subject Participation

You have the right to access, correct, and delete your personal information. See Section 6 below for details.

5. Consent and Lawful Basis

By registering on the Platform and submitting your content, you provide explicit consent for us to process your personal information as described in this policy.

Where consent is not the appropriate lawful basis, we rely on:

Contractual necessity: Processing required to fulfil our distribution agreement with you.
Legal obligation: Processing required to comply with South African tax and regulatory laws.
Legitimate interest: Processing necessary for fraud prevention and service improvement.

6. Your Rights Under POPIA

As a data subject, you have the following rights:

Right to Access: Request confirmation of whether we hold your personal information and request a copy.
Right to Correction: Request correction of inaccurate or misleading personal information.
Right to Deletion: Request deletion of personal information that is no longer necessary or was unlawfully processed.
Right to Object: Object to processing of personal information for direct marketing purposes.
Right to Restrict Processing: Request that we restrict processing of your personal information in certain circumstances.
Right to Data Portability: Request your personal information in a structured, machine-readable format.
Right to Complain: Lodge a complaint with the Information Regulator if you believe your rights have been violated.

To exercise any of these rights, contact us at info@ffpradio.co.za. We will respond within 30 days.

7. Cross-Border Data Transfers

As a digital music distributor, we transmit content metadata and limited personal information to DSPs located outside South Africa (e.g., Spotify, Apple Music, YouTube).

We ensure that:

Cross-border transfers are only made to countries with adequate data protection laws or under appropriate safeguards.
Contracts with international DSPs include data protection clauses.
You are informed of the countries to which your information may be transferred.

8. Data Security Measures

We implement the following security measures to protect your personal information:

SSL/TLS encryption for all data transmission.
Secure password hashing and two-factor authentication.
Regular security audits and vulnerability assessments.
Access controls limiting data access to authorised personnel only.
Secure backup and disaster recovery procedures.
Employee training on data protection and POPIA compliance.

9. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including:

Active account period plus 5 years for tax and legal compliance.
Royalty records for 7 years in accordance with South African tax law.
After the retention period, personal information is securely deleted or anonymised.

10. Contact and Complaints

Information Officer: Malcolm Lewis
Email: info@ffpradio.co.za
Phone: +27 12 345 6789
Address: 10 Manning Street, Margate, KwaZulu-Natal, South Africa

Information Regulator of South Africa:
Website: www.inforegulator.org.za
Email: inforeg@justice.gov.za